diff --git a/go.mod b/go.mod
index dce8e2c2c8..ae66b3b7c1 100644
--- a/go.mod
+++ b/go.mod
@@ -19,7 +19,6 @@ require (
 	github.com/AlekSi/pointer v1.2.0
 	github.com/ClickHouse/clickhouse-go/v2 v2.23.0
 	github.com/DATA-DOG/go-sqlmock v1.5.0
-	github.com/Percona-Lab/kingpin v2.2.6+incompatible
 	github.com/alecthomas/kong v0.9.0
 	github.com/alecthomas/units v0.0.0-20231202071711-9a357b53e9c9
 	github.com/aws/aws-sdk-go v1.55.3
diff --git a/go.sum b/go.sum
index ff619ebbe1..bdf9c3288e 100644
--- a/go.sum
+++ b/go.sum
@@ -34,8 +34,6 @@ github.com/Percona-Lab/go-grpc-prometheus v0.0.0-20230116133345-3487748d4592 h1:
 github.com/Percona-Lab/go-grpc-prometheus v0.0.0-20230116133345-3487748d4592/go.mod h1:xCJfGpj56ERA85Mj1VfBzoeWW4lZ00xXXkvG0LJQjZU=
 github.com/Percona-Lab/kingpin v2.2.6-percona+incompatible h1:N5oM40aAatvf8bCYjv69YsVdxJLIUhY/MerUG1jRL9Y=
 github.com/Percona-Lab/kingpin v2.2.6-percona+incompatible/go.mod h1:UC6j/e2eqpHBB/vn+5214ExsoDLiEo6BfUGBhbtf+x0=
-github.com/Percona-Lab/kingpin v2.2.6+incompatible h1:i7fo0CKR6IGSxe9ErG2DMFz/shUK6vRigVfyQqOyWvs=
-github.com/Percona-Lab/kingpin v2.2.6+incompatible/go.mod h1:UC6j/e2eqpHBB/vn+5214ExsoDLiEo6BfUGBhbtf+x0=
 github.com/Percona-Lab/spec v0.20.5-percona h1:ViCJVq52QIZxpP8/Nv4/nIed+WnqUirNjPtXvHhset4=
 github.com/Percona-Lab/spec v0.20.5-percona/go.mod h1:2OpW+JddWPrpXSCIX8eOx7lZ5iyuWj3RYR6VaaBKcWA=
 github.com/PuerkitoBio/goquery v1.5.1/go.mod h1:GsLWisAFVj4WgDibEWF4pvYnkVQBpKBKeU+7zCJoLcc=
diff --git a/managed/cmd/pmm-encryption-rotation/main.go b/managed/cmd/pmm-encryption-rotation/main.go
index fe369c6133..e5a4f7f410 100644
--- a/managed/cmd/pmm-encryption-rotation/main.go
+++ b/managed/cmd/pmm-encryption-rotation/main.go
@@ -20,7 +20,7 @@ import (
 	"os/signal"
 	"syscall"
 
-	"github.com/Percona-Lab/kingpin"
+	"github.com/alecthomas/kong"
 	"github.com/sirupsen/logrus"
 
 	"github.com/percona/pmm/managed/models"
@@ -44,47 +44,44 @@ func main() {
 	os.Exit(statusCode)
 }
 
-func setupParams() models.SetupDBParams {
-	postgresAddrF := kingpin.Flag("postgres-addr", "PostgreSQL address").
-		Default(models.DefaultPostgreSQLAddr).
-		Envar("PMM_POSTGRES_ADDR").
-		String()
-	postgresDBNameF := kingpin.Flag("postgres-name", "PostgreSQL database name").
-		Default("pmm-managed").
-		Envar("PMM_POSTGRES_DBNAME").
-		String()
-	postgresDBUsernameF := kingpin.Flag("postgres-username", "PostgreSQL database username").
-		Default("pmm-managed").
-		Envar("PMM_POSTGRES_USERNAME").
-		String()
-	postgresSSLModeF := kingpin.Flag("postgres-ssl-mode", "PostgreSQL SSL mode").
-		Default(models.DisableSSLMode).
-		Envar("PMM_POSTGRES_SSL_MODE").
-		Enum(models.DisableSSLMode, models.RequireSSLMode, models.VerifyCaSSLMode, models.VerifyFullSSLMode)
-	postgresSSLCAPathF := kingpin.Flag("postgres-ssl-ca-path", "PostgreSQL SSL CA root certificate path").
-		Envar("PMM_POSTGRES_SSL_CA_PATH").
-		String()
-	postgresDBPasswordF := kingpin.Flag("postgres-password", "PostgreSQL database password").
-		Default("pmm-managed").
-		Envar("PMM_POSTGRES_DBPASSWORD").
-		String()
-	postgresSSLKeyPathF := kingpin.Flag("postgres-ssl-key-path", "PostgreSQL SSL key path").
-		Envar("PMM_POSTGRES_SSL_KEY_PATH").
-		String()
-	postgresSSLCertPathF := kingpin.Flag("postgres-ssl-cert-path", "PostgreSQL SSL certificate path").
-		Envar("PMM_POSTGRES_SSL_CERT_PATH").
-		String()
+type flags struct {
+	Address     string `name:"postgres-addr" default:"${address}" help:"PostgreSQL address with port"`
+	DBName      string `name:"postgres-name" default:"pmm-managed" help:"PostgreSQL database name"`
+	DBUsername  string `name:"postgres-username" default:"pmm-managed" help:"PostgreSQL database username name"`
+	DBPassword  string `name:"postgres-password" default:"pmm-managed" help:"PostgreSQL database password"`
+	SSLMode     string `name:"postgres-ssl-mode" default:"${disable_sslmode}" help:"PostgreSQL SSL mode" enum:"${disable_sslmode}, ${require_sslmode},${verify_sslmode}, ${verify_full_sslmode}"`
+	SSLCAPath   string `name:"postgres-ssl-ca-path" help:"PostgreSQL SSL CA root certificate path" type:"path"`
+	SSLKeyPath  string `name:"postgres-ssl-key-path" help:"PostgreSQL SSL key path" type:"path"`
+	SSLCertPath string `name:"postgres-ssl-cert-path" help:"PostgreSQL SSL certificate path" type:"path"`
+}
 
-	kingpin.Parse()
+func setupParams() models.SetupDBParams {
+	var opts flags
+	kong.Parse(
+		&opts,
+		kong.Name("encryption-rotation"),
+		kong.UsageOnError(),
+		kong.ConfigureHelp(kong.HelpOptions{
+			Compact:             true,
+			NoExpandSubcommands: true,
+		}),
+		kong.Vars{
+			"address":             models.DefaultPostgreSQLAddr,
+			"disable_sslmode":     models.DisableSSLMode,
+			"require_sslmode":     models.RequireSSLMode,
+			"verify_sslmode":      models.VerifyCaSSLMode,
+			"verify_full_sslmode": models.VerifyFullSSLMode,
+		},
+	)
 
 	return models.SetupDBParams{
-		Address:     *postgresAddrF,
-		Name:        *postgresDBNameF,
-		Username:    *postgresDBUsernameF,
-		Password:    *postgresDBPasswordF,
-		SSLMode:     *postgresSSLModeF,
-		SSLCAPath:   *postgresSSLCAPathF,
-		SSLKeyPath:  *postgresSSLKeyPathF,
-		SSLCertPath: *postgresSSLCertPathF,
+		Address:     opts.Address,
+		Name:        opts.DBName,
+		Username:    opts.DBUsername,
+		Password:    opts.DBPassword,
+		SSLMode:     opts.SSLMode,
+		SSLCAPath:   opts.SSLCAPath,
+		SSLKeyPath:  opts.SSLKeyPath,
+		SSLCertPath: opts.SSLCertPath,
 	}
 }